vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-109396

Thelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injection via Exports

MEDIUM
4.2
CVSS Score
Published: October 12, 2026 at 03:16 PM UTC
Updated: October 13, 2026 at 08:41 PM UTC
1 product affected across 1 vendorThelia

Using Thelia by Thelia?

Get instant alerts when new vulnerabilities affect Thelia - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM4.2
Exploit prediction
EPSS 0.2%
SSVC
PoC

Description

Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spreadsheet formulas by supplying crafted registration, checkout or newsletter fields. Attackers can submit names, addresses or phone values starting with =, +, - or @ that CSVSerializer exports verbatim, executing formulas in the administrator's spreadsheet application.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

References (7)

Vendor Advisory
Source: cverecord
https://github.com/thelia/thelia/security/advisories/GHSA-gcgv-f8rf-w2wc
Patch
Source: cverecord
https://github.com/thelia/thelia/commit/c00a26f0631ed9de3c4466176db6e808a25034aa
Patch
Source: cverecord
https://github.com/thelia/thelia/commit/6e46059225d87565caf4859ec0f764354e82ce95
Technical Description
Source: cverecord
https://github.com/thelia/thelia/blob/3.2.0/core/lib/Thelia/Core/Serializer/Serializer/CSVSerializer.php
Release Notes
Source: cverecord
https://github.com/thelia/thelia/releases/tag/3.1.2
Release Notes
Source: cverecord
https://github.com/thelia/thelia/releases/tag/3.2.1
Third Party Advisory
Source: cverecord
https://www.vulncheck.com/advisories/thelia-before-3.1.2-and-3.2-x-before-3.2.1-csv-formula-injection-via-exports

SSVC — Action Prioritization

SSVCPoCNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

4.2MEDIUMVulnCheck
Attack Vector
NETWORK
Complexity
HIGH
Privileges
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE
Vector?

Quick Info

StatusDEFERRED
CWE
CWE-1236

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card